Make Dependabot updates safe, fix stale AutoFill UniFFI bindings

[alchaplinsky]

Makes Dependabot updates safe to land, and fixes the iOS AutoFill break the last batch caused.

What's in here

• Fix: AutoFill bindings regenerated for uniffi 0.32. chore(deps): bump uniffi from 0.29.5 to 0.32.2 in /src-tauri #563 bumped uniffi without re-running bindgen.sh. The library reports contract version 30, but the committed Swift expected 29, so the extension hit fatalError("UniFFI contract version mismatch") on its first Rust call. The public Swift API is unchanged.
• CI: the ios job regenerates the bindings and fails on any diff. This is the second stale-bindings break (also 114c345, a doc-comment edit). bindgen.sh now passes --no-format, so its output doesn't depend on the local Xcode.
• dependabot.yml:
  • Safe bumps arrive as one grouped PR per ecosystem.
  • Cargo groups patch bumps only, because Dependabot labels 0.x jumps (uniffi 0.29→0.32, passkey-rs 0.5→0.6, windows-registry 0.5→0.100) as "minor" but they break the API.
  • A 7-day cooldown on new releases.
  • extension/ is now covered (monthly, one PR).
• Patch bumps: libc 0.2.190, objc2 0.6.5, tokio 1.53.2, zeroize 1.9.1 (the open Dependabot PRs, cherry-picked).

Not in here

• passkey-rs 0.6 (open Dependabot PR): it pulls in p256 0.14 alongside the 0.13 the app pins, which the config already warns breaks the COSE key bridge. It needs its own migration that moves p256, coset and rand together.
• The six 2024 npm Dependabot PRs target the old Electron-era master and should be closed.

Testing

• Bindings regenerated with bindgen.sh and checked: contract version 30, new checksums, same public API.
• rowel-autofill builds with --locked.
• Full clippy and the iOS device run were not done locally; CI covers clippy.

Decisions

• adopted · implementation · [ios-autofill] — CI regenerates the committed UniFFI bindings and fails on any diff. — A stale copy compiles but aborts the extension at its first call; it shipped twice.
• adopted · implementation · [dependency-updates] — Cargo Dependabot groups patch bumps only; 0.x minors arrive one per PR. — Dependabot calls 0.x minor jumps "minor", but they break the API.
• adopted · implementation · [dependency-updates] — Dependabot PRs are landed as one batch, not merged one by one. — Each PR is tested against main alone; sequential merges broke main (chore(deps): bump the tauri-rust group across 1 directory with 10 updates #566 → fix(deps): align Tauri plugin npm packages with Rust crates #567).
• constraint · implementation · [dependency-updates, ios-autofill] — Any uniffi bump must re-run src-tauri/crates/autofill/bindgen.sh and commit the output. — The Swift bindings check the contract version and checksums at load.

[greptile-apps]

Confidence Score: 5/5

[High impact] The PR appears safe to merge; no blocking issue remains.

Summary

Updates Dependabot grouping and cooldowns, refreshes AutoFill’s UniFFI bindings, and adds a check that generated files are committed.

• The AutoFill bindings now match the Rust library’s UniFFI contract.
• iOS CI now checks that generated AutoFill bindings are current.
• Dependabot groups routine updates and leaves Cargo API jumps separate.

_{Reviews (2) · Last reviewed commit: "ci: the bindings check also fails on unt..." · Reviewed by Greptile}